OSFI Announces September 2026 Quarterly Release Day and Industry Day on Capital, Crypto, and AI Thre

Key Takeaways

• OSFI will hold its third Quarterly Release Day on September 10, 2026, followed by a virtual Industry Day on September 24, 2026.
• The sessions cover the final Capital Adequacy Requirements (CAR) Guideline 2027, the final crypto-asset capital and liquidity guideline, Guideline E-15 peer review expectations, AI-driven cyber threats, and Data Collection Modernization.
• Compliance teams at federally regulated institutions should register and prepare questions, since these topics carry near-term implementation obligations.

Deep Dive

This is a technical advisory, not a new rule, but it signals that significant final guidance will be published or discussed on September 10, 2026. The Industry Day is the main opportunity to put questions and feedback directly to OSFI subject matter experts. Registration closes at 12 p.m. ET on September 23, 2026. Sessions run from 1:00 p.m. to 3:35 p.m. ET, are virtual, use a single webcast link, and offer simultaneous interpretation in both official languages. Teams can attend only the sessions relevant to them.

The agenda points to several substantive developments. The final CAR Guideline 2027 is intended to align capital requirements more closely with underlying risk, reduce unnecessary capital burden, and support increased lending to smaller corporates. The final Capital and Liquidity Treatment of Crypto-asset Exposures (Banking) Guideline (2027) includes targeted changes made in response to stakeholder feedback, aligning the capital treatment of certain crypto-asset activities with their risks while keeping prudential safeguards. For insurers, OSFI will clarify its 2026 expectations on appointed actuary peer review under Guideline E-15, ahead of the requirements ending January 1, 2027 (announced in September 2025).

Operational and technology items are also featured. A joint OSFI and Canadian Centre for Cyber Security session will cover Frontier AI threats, mitigation measures, and available CCCS support services, reinforcing OSFI's focus on technology and cyber resilience from its Annual Risk Outlook 2026-2027. The Data Collection Modernization session will cover Release 1 Corporate Data, onboarding of federally regulated banks and insurers, and filing through the new Regulatory Data Hub. This implies upcoming reporting process and system changes.

Recommended actions: (1) Register before the deadline and assign attendees by function (capital, treasury, actuarial, technology risk, regulatory reporting). (2) After the September 10 releases, run gap analyses against the final CAR and crypto-asset guidelines, including impacts on capital planning, lending strategy for smaller corporates, and any crypto-asset activities. (3) Insurers should confirm their 2026 peer review approach and plan for the January 1, 2027 transition. (4) Technology risk and cyber teams should review AI threat scenarios and incident response plans against CCCS guidance. (5) Reporting teams should assess readiness for onboarding to the Regulatory Data Hub. (6) Collect questions and feedback in advance.

Risk implications: Missing these sessions creates a risk of misinterpreting final expectations, particularly given the 2027 effective dates for the capital guidelines. The capital changes may alter capital ratios, risk-weighted asset calculations, and business strategy. The data platform transition adds operational and data quality risk if onboarding is poorly prepared. Early engagement allows institutions to shape implementation plans and budgets before regulatory deadlines.

Source: Office of the Superintendent of Financial Institutions